<!DOCTYPE html>
<html>

<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<meta name="theme-color" content="#33474d">
	<title>失落的乐章</title>
	<link rel="stylesheet" href="/css/style.css" />
	
      <link rel="alternate" href="/atom.xml" title="失落的乐章" type="application/atom+xml">
    
</head>

<body>

	<header class="header">
		<nav class="header__nav">
			
				<a href="/archives" class="header__link">Archive</a>
			
				<a href="/tags" class="header__link">Tags</a>
			
				<a href="/atom.xml" class="header__link">RSS</a>
			
		</nav>
		<h1 class="header__title"><a href="/">失落的乐章</a></h1>
		<h2 class="header__subtitle">技术面前，永远都是学生。</h2>
	</header>

	<main>
		
	<span class="different-posts different-posts_earlier">📖 <a href="/page/32">earlier posts</a> 📖</span>




	<article>
	
		<h1><a href="/2017/10/12/LVS/9. LVS原理详解及部署之二：LVS原理详解（3种工作方式8种调度算法）/">LVS原理详解及部署之二：LVS原理详解（3种工作方式8种调度算法）</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="一、集群简介"><a href="#一、集群简介" class="headerlink" title="一、集群简介"></a>一、集群简介</h2><h3 id="什么是集群"><a href="#什么是集群" class="headerlink" title="什么是集群"></a>什么是集群</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;计算机集群简称集群是一种计算机系统，它通过一组松散集成的计算机软件和/或硬件连接起来高度紧密地协作完成计算工作。在某种意义上，他们可以被看作是一台计算机。集群系统中的单个计算机通常称为节点，通常通过局域网连接，但也有其它的可能连接方式。集群计算机通常用来改进单个计算机的计算速度和/或可靠性。一般情况下集群计算机比单个计算机，比如工作站或超级计算机性能价格比要高得多。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;集群就是一组独立的计算机，通过网络连接组合成一个组合来共同完一个任务</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS在企业架构中的位置：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/01.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;以上的架构只是众多企业里面的一种而已。绿色的线就是用户访问请求的数据流向。用户–&gt;LVS负载均衡服务器—&gt;apahce服务器—&gt;mysql服务器&amp;memcache服务器&amp;共享存储服务器。并且我们的mysql、共享存储也能够使用LVS再进行负载均衡。</p>
<h3 id="小结"><a href="#小结" class="headerlink" title="小结"></a>小结</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;集群：就是一组相互独立的计算机，通过高速的网络组成一个计算机系统，每个集群节点都是运行其自己进程的一个独立服务器。对网络用户来讲，网站后端就是一个单一的系统，协同起来向用户提供系统资源，系统服务。</p>
<h3 id="为什么要使用集群"><a href="#为什么要使用集群" class="headerlink" title="为什么要使用集群"></a>为什么要使用集群</h3><h4 id="集群的特点"><a href="#集群的特点" class="headerlink" title="集群的特点"></a>集群的特点</h4><ul>
<li>高性能performance。一些需要很强的运算处理能力比如天气预报，核试验等。这就不是几台计算机能够搞定的。这需要上千台一起来完成这个工作的。</li>
<li>价格有效性：通常一套系统集群架构，只需要几台或数十台服务器主机即可，与动则上百王的专用超级计算机具有更高的性价比。</li>
<li>可伸缩性：当服务器负载压力增长的时候，系统能够扩展来满足需求，且不降低服务质量。</li>
<li>高可用性：尽管部分硬件和软件发生故障，整个系统的服务必须是7*24小时运行的。</li>
</ul>
<h4 id="集群的优势"><a href="#集群的优势" class="headerlink" title="集群的优势"></a>集群的优势</h4><ul>
<li>透明性：如果一部分服务器宕机了业务不受影响，一般耦合度没有那么高，依赖关系没有那么高。比如NFS服务器宕机了其他就挂载不了了，这样依赖性太强。</li>
<li>高性能：访问量增加，能够轻松扩展。</li>
<li>可管理性：整个系统可能在物理上很大，但很容易管理。</li>
<li>可编程性：在集群系统上，容易开发应用程序，门户网站会要求这个。</li>
</ul>
<h4 id="集群分类及不同分类的特点"><a href="#集群分类及不同分类的特点" class="headerlink" title="集群分类及不同分类的特点"></a>集群分类及不同分类的特点</h4><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;计算机集群架构按照功能和结构一般分成以下几类：</p>
<ul>
<li>负载均衡集群（Loadbalancingclusters）简称LBC</li>
<li>高可用性集群（High-availabilityclusters）简称HAC</li>
<li>高性能计算集群（High-perfomanceclusters）简称HPC</li>
<li>网格计算（Gridcomputing）</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;网络上面一般认为是有三个，负载均衡和高可用集群式我们互联网行业常用的集群架构。</p>
<h5 id="负载均衡集群"><a href="#负载均衡集群" class="headerlink" title="负载均衡集群"></a>负载均衡集群</h5><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;负载均衡集群为企业提供了更为实用，性价比更高的系统架构解决方案。负载均衡集群把很多客户集中访问的请求负载压力可能尽可能平均的分摊到计算机集群中处理。客户请求负载通常包括应用程度处理负载和网络流量负载。这样的系统非常适合向使用同一组应用程序为大量用户提供服务。每个节点都可以承担一定的访问请求负载压力，并且可以实现访问请求在各节点之间动态分配，以实现负载均衡。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;负载均衡运行时，一般通过一个或多个前端负载均衡器将客户访问请求分发到后端一组服务器上，从而达到整个系统的高性能和高可用性。这样计算机集群有时也被称为服务器群。一般高可用性集群和负载均衡集群会使用类似的技术，或同时具有高可用性与负载均衡的特点。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;负载均衡集群的作用</p>
<ul>
<li>分担访问流量（负载均衡）</li>
<li>保持业务的连续性（高可用）</li>
</ul>
<h5 id="高可用性集群"><a href="#高可用性集群" class="headerlink" title="高可用性集群"></a>高可用性集群</h5><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;一般是指当集群中的任意一个节点失效的情况下，节点上的所有任务自动转移到其他正常的节点上，并且此过程不影响整个集群的运行，不影响业务的提供。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;类似是集群中运行着两个或两个以上的一样的节点，当某个主节点出现故障的时候，那么其他作为从 节点的节点就会接替主节点上面的任务。从节点可以接管主节点的资源（IP地址，架构身份等），此时用户不会发现提供服务的对象从主节点转移到从节点。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;高可用性集群的作用：当一个机器宕机另一台进行接管。比较常用的高可用集群开源软件有：keepalive，heardbeat。</p>
<h5 id="高性能计算集群"><a href="#高性能计算集群" class="headerlink" title="高性能计算集群"></a>高性能计算集群</h5><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;高性能计算集群采用将计算任务分配到集群的不同计算节点儿提高计算能力，因而主要应用在科学计算领域。比较流行的HPC采用Linux操作系统和其它一些免费软件来完成并行运算。这一集群配置通常被称为Beowulf集群。这类集群通常运行特定的程序以发挥HPCcluster的并行能力。这类程序一般应用特定的运行库, 比如专为科学计算设计的MPI库。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;HPC集群特别适合于在计算中各计算节点之间发生大量数据通讯的计算作业，比如一个节点的中间结果或影响到其它节点计算结果的情况。</p>
<h4 id="常用集群软硬件"><a href="#常用集群软硬件" class="headerlink" title="常用集群软硬件"></a>常用集群软硬件</h4><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;常用开源集群软件有：lvs，keepalived，haproxy，nginx，apache，heartbeat</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;常用商业集群硬件有：F5,Netscaler，Radware，A10等</p>
<h2 id="二、LVS负载均衡集群介绍"><a href="#二、LVS负载均衡集群介绍" class="headerlink" title="二、LVS负载均衡集群介绍"></a>二、LVS负载均衡集群介绍</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;负载均衡集群的作用：提供一种廉价、有效、透明的方法，来扩展网络设备和服务器的负载带宽、增加吞吐量，加强网络数据处理能力、提高网络的灵活性和可用性。</p>
<ul>
<li>把单台计算机无法承受的大规模的并发访问或数据流量分担到多台节点设备上分别处理，减少用户等待响应的时间，提升用户体验。</li>
<li>单个重负载的运算分担到多台节点设备上做并行处理，每个节点设备处理结束后，将结果汇总，返回给用户，系统处理能力得到大幅度提高。</li>
<li>7*24小时的服务保证，任意一个或多个设备节点设备宕机，不能影响到业务。在负载均衡集群中，所有计算机节点都应该提供相同的服务，集群负载均衡获取所有对该服务的如站请求。</li>
</ul>
<h3 id="LVS介绍"><a href="#LVS介绍" class="headerlink" title="LVS介绍"></a>LVS介绍</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS是linux virtual server的简写linux虚拟服务器，是一个虚拟的服务器集群系统，可以再unix/linux平台下实现负载均衡集群功能。该项目在1998年5月由章文嵩博士组织成立。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;以下是LVS官网提供的4篇文章：（非常详细）</p>
<p><a href="http://www.linuxvirtualserver.org/zh/lvs1.html" target="_blank" rel="external">http://www.linuxvirtualserver.org/zh/lvs1.html</a></p>
<p><a href="http://www.linuxvirtualserver.org/zh/lvs2.html" target="_blank" rel="external">http://www.linuxvirtualserver.org/zh/lvs2.html</a></p>
<p><a href="http://www.linuxvirtualserver.org/zh/lvs3.html" target="_blank" rel="external">http://www.linuxvirtualserver.org/zh/lvs3.html</a></p>
<p><a href="http://www.linuxvirtualserver.org/zh/lvs4.html" target="_blank" rel="external">http://www.linuxvirtualserver.org/zh/lvs4.html</a></p>
<h3 id="IPVS发展史"><a href="#IPVS发展史" class="headerlink" title="IPVS发展史"></a>IPVS发展史</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;早在2.2内核时，IPVS就已经以内核补丁的形式出现。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;从2.4.23版本开始ipvs软件就是合并到linux内核的常用版本的内核补丁的集合。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;从2.4.24以后IPVS已经成为linux官方标准内核的一部分</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/02.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;从上图可以看出lpvs是工作在内核层，我们不能够直接操作ipvs，vs负载均衡调度技术是在linux内核中实现的。因此，被称之为linux虚拟服务器。我们使用该软件配置lvs的时候，不能直接配置内核中的ipvs，而需要使用ipvs的管理工具ipvsadm进行管理。通过keepalived也可以管理LVS。</p>
<h3 id="LVS体系结构与工作原理简单描述"><a href="#LVS体系结构与工作原理简单描述" class="headerlink" title="LVS体系结构与工作原理简单描述"></a>LVS体系结构与工作原理简单描述</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS集群负载均衡器接受服务的所有入展客户端的请求，然后根据调度算法决定哪个集群节点来处理回复客户端的请求。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS虚拟服务器的体系如下图所示，一组服务器通过高速的局域网或者地理分布的广域网相互连接，在这组服务器之前有一个负载调度器（load balance）。负载调度器负责将客户的请求调度到真实服务器上。这样这组服务器集群的结构对用户来说就是透明的。客户访问集群系统就如只是访问一台高性能，高可用的服务器一样。客户程序不受服务器集群的影响，不做任何修改。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;就比如说：我们去饭店吃饭点菜，客户只要跟服务员点菜就行。并不需要知道具体他们是怎么分配工作的，所以他们内部对于我们来说是透明的。此时这个服务员就会按照一定的规则把他手上的活，分配到其他人员上去。这个服务员就是负载均衡器（LB）而后面这些真正做事的就是服务器集群。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;底下是官网提供的结构图：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/03.jpeg?raw=true" alt=""></figure></p>
<h3 id="LVS的基本工作过程"><a href="#LVS的基本工作过程" class="headerlink" title="LVS的基本工作过程"></a>LVS的基本工作过程</h3><p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/04.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;客户请发送向负载均衡服务器发送请求。负载均衡器接受客户的请求，然后先是根据LVS的调度算法（8种）来决定要将这个请求发送给哪个节点服务器。然后依据自己的工作模式（3种）来看应该如何把这些客户的请求如何发送给节点服务器，节点服务器又应该如何来把响应数据包发回给客户端。<br>恩，那这样我们就只要接下来搞懂LVS的3中工作模式，8种调度算法就可以了。</p>
<h3 id="LVS的三种工作模式："><a href="#LVS的三种工作模式：" class="headerlink" title="LVS的三种工作模式："></a>LVS的三种工作模式：</h3><ul>
<li>VS/NAT模式（Network address translation）</li>
<li>VS/TUN模式（tunneling）</li>
<li>DR模式（Direct routing）</li>
</ul>
<h4 id="1、NAT模式-网络地址转换"><a href="#1、NAT模式-网络地址转换" class="headerlink" title="1、NAT模式-网络地址转换"></a>1、NAT模式-网络地址转换</h4><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Virtualserver via Network address translation(VS/NAT)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这个是通过网络地址转换的方法来实现调度的。首先调度器(LB)接收到客户的请求数据包时（请求的目的IP为VIP），根据调度算法决定将请求发送给哪个后端的真实服务器（RS）。然后调度就把客户端发送的请求数据包的目标IP地址及端口改成后端真实服务器的IP地址（RIP）,这样真实服务器（RS）就能够接收到客户的请求数据包了。真实服务器响应完请求后，查看默认路由（NAT模式下我们需要把RS的默认路由设置为LB服务器。）把响应后的数据包发送给LB,LB再接收到响应包后，把包的源地址改成虚拟地址（VIP）然后发送回给客户端。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;调度过程IP包详细图：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/05.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;原理图简述：</p>
<ol>
<li>客户端请求数据，目标IP为VIP</li>
<li>请求数据到达LB服务器，LB根据调度算法将目的地址修改为RIP地址及对应端口（此RIP地址是根据调度算法得出的。）并在连接HASH表中记录下这个连接。</li>
<li>数据包从LB服务器到达RS服务器webserver，然后webserver进行响应。Webserver的网关必须是LB，然后将数据返回给LB服务器。</li>
<li>收到RS的返回后的数据，根据连接HASH表修改源地址VIP&amp;目标地址CIP，及对应端口80.然后数据就从LB出发到达客户端。</li>
<li>客户端收到的就只能看到VIP\DIP信息。</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;NAT模式优缺点：</p>
<ol>
<li>NAT技术将请求的报文和响应的报文都需要通过LB进行地址改写，因此网站访问量比较大的时候LB负载均衡调度器有比较大的瓶颈，一般要求最多之能10-20台节点</li>
<li>只需要在LB上配置一个公网IP地址就可以了。</li>
<li>每台内部的节点服务器的网关地址必须是调度器LB的内网地址。</li>
<li>NAT模式支持对IP地址和端口进行转换。即用户请求的端口和真实服务器的端口可以不一致。</li>
</ol>
<h4 id="2、TUN模式"><a href="#2、TUN模式" class="headerlink" title="2、TUN模式"></a>2、TUN模式</h4><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;virtual server via ip tunneling模式:采用NAT模式时，由于请求和响应的报文必须通过调度器地址重写，当客户请求越来越多时，调度器处理能力将成为瓶颈。为了解决这个问题，调度器把请求的报文通过IP隧道转发到真实的服务器。真实的服务器将响应处理后的数据直接返回给客户端。这样调度器就只处理请求入站报文，由于一般网络服务应答数据比请求报文大很多，采用VS/TUN模式后，集群系统的最大吞吐量可以提高10倍。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;VS/TUN的工作流程图如下所示，它和NAT模式不同的是，它在LB和RS之间的传输不用改写IP地址。而是把客户请求包封装在一个IP tunnel里面，然后发送给RS节点服务器，节点服务器接收到之后解开IP tunnel后，进行响应处理。并且直接把包通过自己的外网地址发送给客户不用经过LB服务器。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Tunnel原理流程图:</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/06.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;原理图过程简述：</p>
<ol>
<li>客户请求数据包，目标地址VIP发送到LB上。</li>
<li>LB接收到客户请求包，进行IP Tunnel封装。即在原有的包头加上IP Tunnel的包头。然后发送出去。</li>
<li>RS节点服务器根据IP Tunnel包头信息（此时就又一种逻辑上的隐形隧道，只有LB和RS之间懂）收到请求包，然后解开IP Tunnel包头信息，得到客户的请求包并进行响应处理。<br>4.响应处理完毕之后，RS服务器使用自己的出公网的线路，将这个响应数据包发送给客户端。源IP地址还是VIP地址。（RS节点服务器需要在本地回环接口配置VIP，后续会讲）</li>
</ol>
<h4 id="3、DR模式（直接路由模式）"><a href="#3、DR模式（直接路由模式）" class="headerlink" title="3、DR模式（直接路由模式）"></a>3、DR模式（直接路由模式）</h4><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Virtual server via direct routing (vs/dr)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式是通过改写请求报文的目标MAC地址，将请求发给真实服务器的，而真实服务器响应后的处理结果直接返回给客户端用户。同TUN模式一样，DR模式可以极大的提高集群系统的伸缩性。而且DR模式没有IP隧道的开销，对集群中的真实服务器也没有必要必须支持IP隧道协议的要求。但是要求调度器LB与真实服务器RS都有一块网卡连接到同一物理网段上，必须在同一个局域网环境。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式是互联网使用比较多的一种模式。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式原理图：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/07.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式原理过程简述：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;VS/DR模式的工作流程图如上图所示，它的连接调度和管理与NAT和TUN中的一样，它的报文转发方法和前两种不同。DR模式将报文直接路由给目标真实服务器。在DR模式中，调度器根据各个真实服务器的负载情况，连接数多少等，动态地选择一台服务器，不修改目标IP地址和目标端口，也不封装IP报文，而是将请求报文的数据帧的目标MAC地址改为真实服务器的MAC地址。然后再将修改的数据帧在服务器组的局域网上发送。因为数据帧的MAC地址是真实服务器的MAC地址，并且又在同一个局域网。那么根据局域网的通讯原理，真实复位是一定能够收到由LB发出的数据包。真实服务器接收到请求数据包的时候，解开IP包头查看到的目标IP是VIP。（此时只有自己的IP符合目标IP才会接收进来，所以我们需要在本地的回环借口上面配置VIP。另：由于网络接口都会进行ARP广播响应，但集群的其他机器都有这个VIP的lo接口，都响应就会冲突。所以我们需要把真实服务器的lo接口的ARP响应关闭掉。）然后真实服务器做成请求响应，之后根据自己的路由信息将这个响应数据包发送回给客户，并且源IP地址还是VIP。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式小结：</p>
<ol>
<li>通过在调度器LB上修改数据包的目的MAC地址实现转发。注意源地址仍然是CIP，目的地址仍然是VIP地址。</li>
<li>请求的报文经过调度器，而RS响应处理后的报文无需经过调度器LB，因此并发访问量大时使用效率很高（和NAT模式比）</li>
<li>因为DR模式是通过MAC地址改写机制实现转发，因此所有RS节点和调度器LB只能在一个局域网里面</li>
<li>RS主机需要绑定VIP地址在LO接口上，并且需要配置ARP抑制。</li>
<li>RS节点的默认网关不需要配置成LB，而是直接配置为上级路由的网关，能让RS直接出网就可以。</li>
<li>由于DR模式的调度器仅做MAC地址的改写，所以调度器LB就不能改写目标端口，那么RS服务器就得使用和VIP相同的端口提供服务。</li>
</ol>
<h3 id="官方三种负载均衡技术比较总结表："><a href="#官方三种负载均衡技术比较总结表：" class="headerlink" title="官方三种负载均衡技术比较总结表："></a>官方三种负载均衡技术比较总结表：</h3><table>
<thead>
<tr>
<th>工作模式</th>
<th>VS/NAT</th>
<th>VS/TUN</th>
<th>VS/DR</th>
</tr>
</thead>
<tbody>
<tr>
<td>Real server（节点服务器）</td>
<td>Config dr gw</td>
<td>Tunneling</td>
<td>Non-arp device/tie vip</td>
</tr>
<tr>
<td>Server Network</td>
<td>Private</td>
<td>LAN/WAN</td>
<td>LAN</td>
</tr>
<tr>
<td>Server number（节点数量）</td>
<td>Low 10-20</td>
<td>High 100</td>
<td>High 100</td>
</tr>
<tr>
<td>Real server gateway</td>
<td>Load balance</td>
<td>Own router</td>
<td>Own router</td>
</tr>
<tr>
<td>优点</td>
<td>地址和端口转换</td>
<td>Wan环境加密数据</td>
<td>性能最高</td>
</tr>
<tr>
<td>缺点</td>
<td>效率低</td>
<td>需要隧道支持</td>
<td>不能跨域LAN</td>
</tr>
</tbody>
</table>
<h3 id="LVS调度算法"><a href="#LVS调度算法" class="headerlink" title="LVS调度算法"></a>LVS调度算法</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;最好参考此文章：<a href="http://www.linuxvirtualserver.org/zh/lvs4.html" target="_blank" rel="external">http://www.linuxvirtualserver.org/zh/lvs4.html</a></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Lvs的调度算法决定了如何在集群节点之间分布工作负荷。当director调度器收到来自客户端访问VIP的上的集群服务的入站请求时，director调度器必须决定哪个集群节点应该处理请求。Director调度器用的调度方法基本分为两类：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;固定调度算法：rr，wrr，dh，sh</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;动态调度算法：wlc，lc，lblc，lblcr</p>
<table>
<thead>
<tr>
<th>算法</th>
<th>说明</th>
</tr>
</thead>
<tbody>
<tr>
<td>rr</td>
<td>轮询算法，它将请求依次分配给不同的rs节点，也就是RS节点中均摊分配。这种算法简单，但只适合于RS节点处理性能差不多的情况</td>
</tr>
<tr>
<td>wrr</td>
<td>加权轮训调度，它将依据不同RS的权值分配任务。权值较高的RS将优先获得任务，并且分配到的连接数将比权值低的RS更多。相同权值的RS得到相同数目的连接数。</td>
</tr>
<tr>
<td>Wlc</td>
<td>加权最小连接数调度，假设各台RS的全职依次为Wi，当前tcp连接数依次为Ti，依次去Ti/Wi为最小的RS作为下一个分配的RS</td>
</tr>
<tr>
<td>Dh</td>
<td>目的地址哈希调度（destination hashing）以目的地址为关键字查找一个静态hash表来获得需要的RSSH源地址哈希调度（source hashing）以源地址为关键字查找一个静态hash表来获得需要的RS</td>
</tr>
<tr>
<td>Lc</td>
<td>最小连接数调度（least-connection）,IPVS表存储了所有活动的连接。LB会比较将连接请求发送到当前连接最少的RS.</td>
</tr>
<tr>
<td>Lblc</td>
<td>基于地址的最小连接数调度（locality-based least-connection）：将来自同一个目的地址的请求分配给同一台RS，此时这台服务器是尚未满负荷的。否则就将这个请求分配给连接数最小的RS，并以它作为下一次分配的首先考虑。</td>
</tr>
</tbody>
</table>
<h3 id="LVS调度算法的生产环境选型："><a href="#LVS调度算法的生产环境选型：" class="headerlink" title="LVS调度算法的生产环境选型："></a>LVS调度算法的生产环境选型：</h3><ol>
<li>一般的网络服务，如http，mail，mysql等常用的LVS调度算法为：</li>
</ol>
<ul>
<li>基本轮询调度rr</li>
<li>加权最小连接调度wlc</li>
<li>加权轮询调度wrc</li>
</ul>
<ol>
<li><p>基于局部性的最小连接lblc和带复制的给予局部性最小连接lblcr主要适用于web cache和DB cache</p>
</li>
<li><p>源地址散列调度SH和目标地址散列调度DH可以结合使用在防火墙集群中，可以保证整个系统的出入口唯一。</p>
</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;实际适用中这些算法的适用范围很多，工作中最好参考内核中的连接调度算法的实现原理，然后根据具体的业务需求合理的选型。</p>
<h3 id="小结-1"><a href="#小结-1" class="headerlink" title="小结"></a>小结</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;基本上lvs的原理部分就到这里，个人还是觉得像要对LVS有一个比较全面的认识，还是需要去将官方文档认真的看过一遍。主要部分还是在于3种工作方式和8种调度算法。以及实际工作种什么样的生产环境适用哪种调度算法。</p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/8. LVS原理详解及部署之一：ARP原理准备/">LVS原理详解及部署之一：ARP原理准备</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="一、ARP技术概念介绍"><a href="#一、ARP技术概念介绍" class="headerlink" title="一、ARP技术概念介绍"></a>一、ARP技术概念介绍</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;为什么讲ARP技术，因为平常工作中有接触。还有就是LVS的dr模式是用到arp的技术和数据。</p>
<h3 id="1、什么是ARP协议"><a href="#1、什么是ARP协议" class="headerlink" title="1、什么是ARP协议"></a>1、什么是ARP协议</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ARP协议全程地址解析协议（AddressResolution Protocol，ARP）是在仅知道主机的IP地址时确定其物理地址的一种协议。因IPv4和以太网的广泛应用，其主要作用是通过已知IP地址，获取对应物理地址的一种协议。</p>
<h3 id="2、什么是ARP代理（ARP-proxy）"><a href="#2、什么是ARP代理（ARP-proxy）" class="headerlink" title="2、什么是ARP代理（ARP proxy）"></a>2、什么是ARP代理（ARP proxy）</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在网络中代理是非常常见的，所谓的代理就是我朝一个人要，另外一个人给。生活中一个比较实际的例子就是，房屋中介。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Arp协议要求通信的主机的双方必须是在物理的同一个网段。那如果发送主机和目标主机不是在同一个局域网里，而ARP广播包是不能够跨越网段进行传输的。所以此时就需要一个路由或ARP中继技术来转发ARP请求包。客户端获取到的MAC地址是路由器或者中继的MAC地址。那么之后这个客户端发给目的端的数据，都会先发给这个路由器或ARP中继，再进而转给目的端，这种情况就称为ARP代理。</p>
<h3 id="3、arp协议工作原理"><a href="#3、arp协议工作原理" class="headerlink" title="3、arp协议工作原理"></a>3、arp协议工作原理</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;原理图：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%B8%80%EF%BC%9AARP%E5%8E%9F%E7%90%86%E5%87%86%E5%A4%87/01.jpeg?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当主机10.0.0.1要发送数据给10.0.0.2数据，会首先去查本地的arp缓存表，如果有此IP地址和此主机对应的MAC地址，如果有就可以直接传输数据。如果没有就主机10.0.0.1就会向局域网去广播，询问谁的IP地址是10.0.0.2.此时在本局域网中的所有主机都能够收到此广播包，但只有主机10.0.0.2才会回应这个广播包。会以单播的形式直接回复10.0.0.2说我的MAC地址为多少。此时10.0.0.1收到了此信息，那么两者之间就能够通过MAC地址进行通信了。并且将这个ARP和IP对应信息缓存到ARP缓存表里。</p>
<h4 id="ARP欺骗工作原理："><a href="#ARP欺骗工作原理：" class="headerlink" title="ARP欺骗工作原理："></a>ARP欺骗工作原理：</h4><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ARP欺骗就是通过伪造IP地址和MAC地址对实现ARP欺骗的，它能够在网络中产生大量的ARP包，来让网络堵塞。攻击主机只要持续的发送假的ARP包，让网络中的主机缓存错误的IP-MAC对应信心，造成网络中断或中间人攻击。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ARP攻击主要是在局域网中的，因为ARP包是不会垮网络传播的。所以划分VLAN能够减少当受到ARP攻击后，网络受影响的范围。</p>
<h4 id="ARP欺骗过程图及讲解："><a href="#ARP欺骗过程图及讲解：" class="headerlink" title="ARP欺骗过程图及讲解："></a>ARP欺骗过程图及讲解：</h4><p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%B8%80%EF%BC%9AARP%E5%8E%9F%E7%90%86%E5%87%86%E5%A4%87/02.jpeg?raw=true" alt=""></figure></p>
<h4 id="ARP欺骗防御办法"><a href="#ARP欺骗防御办法" class="headerlink" title="ARP欺骗防御办法"></a>ARP欺骗防御办法</h4><ul>
<li>进行MAC和IP地址进行绑定</li>
<li>杀毒软件开启arp防火墙</li>
</ul>
<h4 id="ARP病毒排查"><a href="#ARP病毒排查" class="headerlink" title="ARP病毒排查"></a>ARP病毒排查</h4><ul>
<li>使用arp –a命令查看本地arp缓存表，查看重复MAC地址或在交换机路由器上查看重复MAC地址。</li>
<li>使用ARP防御软件或检测软件（如：科莱，彩影arp防火墙分析流量，查找可以攻击源）</li>
<li>使用折半法排除网络出错范围。（如先断开一般的网络查看是否正常，如果正常就说明断开的那部分有问题。然后再接上剩下的那一半继续查看，依次类推最终找到问题点）<br>当然排查、预防ARP攻击的方法有很多，大家可以自己寻找。</li>
</ul>
<h2 id="小结"><a href="#小结" class="headerlink" title="小结"></a>小结</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;ARP协议的功能就是能够通过IP地址解析到MAC地址。而ARP欺骗的手段就是通过伪造IP-MAC信息，让网络上的主机受骗。误以为攻击主机就是他们要发送的目标主机（路由器）这样就将信息都发给了攻击者，攻击者就能获取网络其他主机的数据包。而且网络上的主机会出现网络中断等现象。如果攻击者在网络上大量的发送ARP信息，也会造成网络的堵塞。</p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/6. keepalived 工作原理和配置说明/">keepalived 工作原理和配置说明</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a> <a class="article__tag-link" href="/tags/keepalived/">keepalived</a>
			</span>
		
	</div>

	

	
		<h2 id="keepalived是什么"><a href="#keepalived是什么" class="headerlink" title="keepalived是什么"></a>keepalived是什么</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;keepalived是集群管理中保证集群高可用的一个服务软件，其功能类似于heartbeat，用来防止单点故障。</p>
<h2 id="keepalived工作原理"><a href="#keepalived工作原理" class="headerlink" title="keepalived工作原理"></a>keepalived工作原理</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;keepalived是以VRRP协议为实现基础的，VRRP全称Virtual Router Redundancy Protocol，即虚拟路由冗余协议。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;虚拟路由冗余协议，可以认为是实现路由器高可用的协议，即将N台提供相同功能的路由器组成一个路由器组，这个组里面有一个master和多个backup，master上面有一个对外提供服务的vip（该路由器所在局域网内其他机器的默认路由为该vip），master会发组播，当backup收不到vrrp包时就认为master宕掉了，这时就需要根据VRRP的优先级来选举一个backup当master。这样的话就可以保证路由器的高可用了。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;keepalived主要有三个模块，分别是core、check和vrrp。core模块为keepalived的核心，负责主进程的启动、维护以及全局配置文件的加载和解析。check负责健康检查，包括常见的各种检查方式。vrrp模块是来实现VRRP协议的。</p>
<h2 id="keepalived的配置文件"><a href="#keepalived的配置文件" class="headerlink" title="keepalived的配置文件"></a>keepalived的配置文件</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;keepalived只有一个配置文件keepalived.conf，里面主要包括以下几个配置区域，分别是global_defs、static_ipaddress、static_routes、vrrp_script、vrrp_instance和virtual_server。</p>
<h3 id="global-defs区域"><a href="#global-defs区域" class="headerlink" title="global_defs区域"></a>global_defs区域</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;主要是配置故障发生时的通知对象以及机器标识</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div></pre></td><td class="code"><pre><div class="line">global_defs &#123;</div><div class="line">    notification_email &#123;</div><div class="line">        a@abc.com</div><div class="line">        b@abc.com</div><div class="line">        ...</div><div class="line">    &#125;</div><div class="line">    notification_email_from alert@abc.com</div><div class="line">    smtp_server smtp.abc.com</div><div class="line">    smtp_connect_timeout 30</div><div class="line">    enable_traps</div><div class="line">    router_id host163</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<ul>
<li>notification_email 故障发生时给谁发邮件通知。</li>
<li>notification_email_from 通知邮件从哪个地址发出。</li>
<li>smpt_server 通知邮件的smtp地址。</li>
<li>smtp_connect_timeout 连接smtp服务器的超时时间。</li>
<li>enable_traps 开启SNMP陷阱（<a href="https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol" target="_blank" rel="external">Simple Network Management Protocol</a>）。</li>
<li>router_id 标识本节点的字条串，通常为hostname，但不一定非得是hostname。故障发生时，邮件通知会用到。</li>
</ul>
<h3 id="static-ipaddress和static-routes区域"><a href="#static-ipaddress和static-routes区域" class="headerlink" title="static_ipaddress和static_routes区域"></a>static_ipaddress和static_routes区域</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;static_ipaddress和static_routes区域配置的是是本节点的IP和路由信息。如果你的机器上已经配置了IP和路由，那么这两个区域可以不用配置。其实，一般情况下你的机器都会有IP地址和路由信息的，因此没必要再在这两个区域配置。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div></pre></td><td class="code"><pre><div class="line">static_ipaddress &#123;</div><div class="line">    10.210.214.163/24 brd 10.210.214.255 dev eth0</div><div class="line">    ...</div><div class="line">&#125;</div><div class="line">static_routes &#123;</div><div class="line">    10.0.0.0/8 via 10.210.214.1 dev eth0</div><div class="line">    ...</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;以上分别表示启动/关闭keepalived时在本机执行的如下命令：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line">/sbin/ip addr add 10.210.214.163/24 brd 10.210.214.255 dev eth0</div><div class="line">/sbin/ip route add 10.0.0.0/8 via 10.210.214.1 dev eth0</div><div class="line">/sbin/ip addr del 10.210.214.163/24 brd 10.210.214.255 dev eth0</div><div class="line">/sbin/ip route del 10.0.0.0/8 via 10.210.214.1 dev eth0</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;注意： 请忽略这两个区域，因为我坚信你的机器肯定已经配置了IP和路由。</p>
<h3 id="vrrp-script区域"><a href="#vrrp-script区域" class="headerlink" title="vrrp_script区域"></a>vrrp_script区域</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;用来做健康检查的，当时检查失败时会将vrrp_instance的priority减少相应的值。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div></pre></td><td class="code"><pre><div class="line">vrrp_script check_alive</div><div class="line">&#123;</div><div class="line">        script <span class="string">"/export/sh/check_nginx_alive.sh"</span></div><div class="line">        <span class="comment"># check every 2 seconds</span></div><div class="line">        interval 2</div><div class="line">        <span class="comment"># if failed, decrease 10 of the priority</span></div><div class="line">        weight -10</div><div class="line">        <span class="comment"># require 2 failures for failures</span></div><div class="line">        fail 2</div><div class="line">        <span class="comment"># require 1 sucesses for ok</span></div><div class="line">        rise 1</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;以上意思是如果script中的指令执行失败，那么相应的vrrp_instance的优先级会减少10个点。</p>
<h3 id="vrrp-instance和vrrp-sync-group区域"><a href="#vrrp-instance和vrrp-sync-group区域" class="headerlink" title="vrrp_instance和vrrp_sync_group区域"></a>vrrp_instance和vrrp_sync_group区域</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;vrrp_instance用来定义对外提供服务的VIP区域及其相关属性。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;vrrp_rsync_group用来定义vrrp_intance组，使得这个组内成员动作一致。举个例子来说明一下其功能：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;两个vrrp_instance同属于一个vrrp_rsync_group，那么其中一个vrrp_instance发生故障切换时，另一个vrrp_instance也会跟着切换（即使这个instance没有发生故障）。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div></pre></td><td class="code"><pre><div class="line">vrrp_sync_group VG_1 &#123;</div><div class="line">    group &#123;</div><div class="line">        inside_network   <span class="comment"># name of vrrp_instance (below)</span></div><div class="line">        outside_network  <span class="comment"># One for each moveable IP.</span></div><div class="line">        ...</div><div class="line">    &#125;</div><div class="line">    notify_master /path/to_master.sh</div><div class="line">    notify_backup /path/to_backup.sh</div><div class="line">    notify_fault <span class="string">"/path/fault.sh VG_1"</span></div><div class="line">    notify /path/notify.sh</div><div class="line">    smtp_alert</div><div class="line">&#125;</div><div class="line">vrrp_instance VI_1 &#123;</div><div class="line">    state MASTER</div><div class="line">    interface eth0</div><div class="line">    use_vmac </div><div class="line">    dont_track_primary</div><div class="line">    track_interface &#123;</div><div class="line">        eth0</div><div class="line">        eth1</div><div class="line">    &#125;</div><div class="line">    mcast_src_ip </div><div class="line">    lvs_sync_daemon_interface eth1</div><div class="line">    garp_master_delay 10</div><div class="line">    virtual_router_id 1</div><div class="line">    priority 100</div><div class="line">    advert_int 1</div><div class="line">    authentication &#123;</div><div class="line">        auth_type PASS</div><div class="line">        auth_pass 12345678</div><div class="line">    &#125;</div><div class="line">    virtual_ipaddress &#123;</div><div class="line">        10.210.214.253/24 brd 10.210.214.255 dev eth0</div><div class="line">        192.168.1.11/24 brd 192.168.1.255 dev eth1</div><div class="line">    &#125;</div><div class="line">    virtual_routes &#123;</div><div class="line">        172.16.0.0/12 via 10.210.214.1</div><div class="line">        192.168.1.0/24 via 192.168.1.1 dev eth1</div><div class="line">        default via 202.102.152.1</div><div class="line">    &#125;</div><div class="line">    track_script &#123;</div><div class="line">        chk_http_port</div><div class="line">    &#125;</div><div class="line">    nopreempt</div><div class="line">    preempt_delay 300</div><div class="line">    debug</div><div class="line">    notify_master |</div><div class="line">    notify_backup |</div><div class="line">    notify_fault |</div><div class="line">    notify |</div><div class="line">    smtp_alert</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<ul>
<li>notify_master/backup/fault 分别表示切换为主/备/出错时所执行的脚本。</li>
<li>notify 表示任何一状态切换时都会调用该脚本，并且该脚本在以上三个脚本执行完成之后进行调用，keepalived会自动传递三个参数（$1 = “GROUP”|”INSTANCE”，$2 = name of group or instance，$3 = target state of transition(MASTER/BACKUP/FAULT)）。</li>
<li>smtp_alert 表示是否开启邮件通知（用全局区域的邮件设置来发通知）。</li>
<li>state 可以是MASTER或BACKUP，不过当其他节点keepalived启动时会将priority比较大的节点选举为MASTER，因此该项其实没有实质用途。</li>
<li>interface 节点固有IP（非VIP）的网卡，用来发VRRP包。</li>
<li>use_vmac 是否使用VRRP的虚拟MAC地址。</li>
<li>dont_track_primary 忽略VRRP网卡错误。（默认未设置）</li>
<li>track_interface 监控以下网卡，如果任何一个不通就会切换到FALT状态。（可选项）</li>
<li>mcast_src_ip 修改vrrp组播包的源地址，默认源地址为master的IP。（由于是组播，因此即使修改了源地址，该master还是能收到回应的）</li>
<li>lvs_sync_daemon_interface 绑定lvs syncd的网卡。</li>
<li>garp_master_delay 当切为主状态后多久更新ARP缓存，默认5秒。</li>
<li>virtual_router_id 取值在0-255之间，用来区分多个instance的VRRP组播。</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;注意： 同一网段中virtual_router_id的值不能重复，否则会出错，相关错误信息如下。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div></pre></td><td class="code"><pre><div class="line">Keepalived_vrrp[27120]: ip address associated with VRID not present <span class="keyword">in</span> received packet :</div><div class="line">one or more VIP associated with VRID mismatch actual MASTER advert</div><div class="line">bogus VRRP packet received on eth1 !!!</div><div class="line">receive an invalid ip number count associated with VRID!</div><div class="line">VRRP_Instance(xxx) ignoring received advertisment...</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;可以用这条命令来查看该网络中所存在的vrid：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">tcpdump -nn -i any net 224.0.0.0/8</div></pre></td></tr></table></figure>
<ul>
<li>priority 用来选举master的，要成为master，那么这个选项的值最好高于其他机器50个点，该项取值范围是1-255（在此范围之外会被识别成默认值100）。</li>
<li>advert_int 发VRRP包的时间间隔，即多久进行一次master选举（可以认为是健康查检时间间隔）。</li>
<li>authentication 认证区域，认证类型有PASS和HA（IPSEC），推荐使用PASS（密码只识别前8位）。</li>
<li>virtual_ipaddress vip，不解释了。</li>
<li>virtual_routes 虚拟路由，当IP漂过来之后需要添加的路由信息。</li>
<li>virtual_ipaddress_excluded 发送的VRRP包里不包含的IP地址，为减少回应VRRP包的个数。在网卡上绑定的IP地址比较多的时候用。</li>
<li>nopreempt 允许一个priority比较低的节点作为master，即使有priority更高的节点启动。</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;首先nopreemt必须在state为BACKUP的节点上才生效（因为是BACKUP节点决定是否来成为MASTER的），其次要实现类似于关闭auto failback的功能需要将所有节点的state都设置为BACKUP，或者将master节点的priority设置的比BACKUP低。我个人推荐使用将所有节点的state都设置成BACKUP并且都加上nopreempt选项，这样就完成了关于autofailback功能，当想手动将某节点切换为MASTER时只需去掉该节点的nopreempt选项并且将priority改的比其他节点大，然后重新加载配置文件即可（等MASTER切过来之后再将配置文件改回去再reload一下）。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当使用track_script时可以不用加nopreempt，只需要加上preempt_delay 5，这里的间隔时间要大于vrrp_script中定义的时长。</p>
<ul>
<li>preempt_delay master启动多久之后进行接管资源（VIP/Route信息等），并提是没有nopreempt选项。</li>
</ul>
<h3 id="virtual-server-group和virtual-server区域"><a href="#virtual-server-group和virtual-server区域" class="headerlink" title="virtual_server_group和virtual_server区域"></a>virtual_server_group和virtual_server区域</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;virtual_server_group一般在超大型的LVS中用到，一般LVS用不过这东西，因此不多说。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div></pre></td><td class="code"><pre><div class="line">virtual_server IP Port &#123;</div><div class="line">    delay_loop </div><div class="line">    lb_algo rr|wrr|lc|wlc|lblc|sh|dh</div><div class="line">    lb_kind NAT|DR|TUN</div><div class="line">    persistence_timeout </div><div class="line">    persistence_granularity </div><div class="line">    protocol TCP</div><div class="line">    ha_suspend</div><div class="line">    virtualhost </div><div class="line">    alpha</div><div class="line">    omega</div><div class="line">    quorum </div><div class="line">    hysteresis </div><div class="line">    quorum_up |</div><div class="line">    quorum_down |</div><div class="line">    sorry_server </div><div class="line">    real_server  &#123;</div><div class="line">        weight </div><div class="line">        inhibit_on_failure</div><div class="line">        notify_up |</div><div class="line">        notify_down |</div><div class="line">        <span class="comment"># HTTP_GET|SSL_GET|TCP_CHECK|SMTP_CHECK|MISC_CHECK</span></div><div class="line">        HTTP_GET|SSL_GET &#123;</div><div class="line">            url &#123;</div><div class="line">                path </div><div class="line">                <span class="comment"># Digest computed with genhash</span></div><div class="line">                digest </div><div class="line">                status_code </div><div class="line">            &#125;</div><div class="line">            connect_port </div><div class="line">            connect_timeout </div><div class="line">            nb_get_retry </div><div class="line">            delay_before_retry </div><div class="line">        &#125;</div><div class="line">    &#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<ul>
<li>delay_loop 延迟轮询时间（单位秒）。</li>
<li>lb_algo 后端调试算法（load balancing algorithm）。</li>
<li>lb_kind LVS调度类型NAT/DR/TUN。</li>
<li>virtualhost 用来给HTTP_GET和SSL_GET配置请求header的。</li>
<li>sorry_server 当所有real server宕掉时，sorry server顶替。</li>
<li>real_server 真正提供服务的服务器。</li>
<li>weight 权重。</li>
<li>notify_up/down 当real server宕掉或启动时执行的脚本。</li>
<li>健康检查的方式，N多种方式。</li>
<li>path 请求real serserver上的路径。</li>
<li>digest/status_code 分别表示用genhash算出的结果和http状态码。</li>
<li>connect_port 健康检查，如果端口通则认为服务器正常。</li>
<li>connect_timeout,nb_get_retry,delay_before_retry分别表示超时时长、重试次数，下次重试的时间延迟。</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;其他选项暂时不作说明。</p>
<h2 id="keepalived主从切换"><a href="#keepalived主从切换" class="headerlink" title="keepalived主从切换"></a>keepalived主从切换</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;主从切换比较让人蛋疼，需要将backup配置文件的priority选项的值调整的比master高50个点，然后reload配置文件就可以切换了。当时你也可以将master的keepalived停止，这样也可以进行主从切换。</p>
<h2 id="keepalived仅做HA时的配置"><a href="#keepalived仅做HA时的配置" class="headerlink" title="keepalived仅做HA时的配置"></a>keepalived仅做HA时的配置</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;请看该文档同级目录下的配置文件示例。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;说明：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;10.210.214.113 为keepalived的备机，其配置文件为113.keepalived.conf</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;10.210.214.163 为keepalived的主机，其配置文件为163.keepalived.conf</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;10.210.214.253 为Virtual IP，即提供服务的内网IP地址，在网卡eth0上面</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;192.168.1.11 为模拟的提供服务的公网IP地址，在网卡eth1上面</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;用tcpdump命令来捕获的结果如下：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">17:20:07.919419 IP 10.210.214.163&gt;224.0.0.18:VRRPv2,Advertisement, vrid 1, prio 200, authtype simple, intvl 1s, length 20</div></pre></td></tr></table></figure>
<h2 id="LVS-Keepalived配置"><a href="#LVS-Keepalived配置" class="headerlink" title="LVS+Keepalived配置"></a>LVS+Keepalived配置</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;注Keepalived与LVS结合使用时一般还会用到一个工具ipvsadm，用来查看相关VS相关状态，关于ipvsadm的用法可以参考man手册。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;10.67.15.95为keepalived master，VIP为10.67.15.94，配置文件为95-lvs-keepalived.conf</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;10.67.15.96为keepalived master，VIP为10.67.15.94，配置文件为96-lvs-keepalived.conf</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;10.67.15.195为real server</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;注意：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当使用LVS+DR+Keepalived配置时，需要在real server上添加一条iptables规则（其中dport根据情况添加或缺省）：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line"><span class="comment"># iptables -t nat -A PREROUTING -p tcp -d 10.67.15.94 --dport 80 -j REDIRECT</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当使用LVS+NAT+Keepalived配置时，需要将real server的默认路由配置成Director的VIP10.67.15.94，必须确保client的请求是通过10.67.15.94到达real server的。</p>
<h2 id="安装keepalived"><a href="#安装keepalived" class="headerlink" title="安装keepalived"></a>安装keepalived</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;从keepalived官网下载合适的版本，解压并执行如下命令完成安装。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line"><span class="comment"># cd keepalived-xxx# ./configure --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --mandir=/usr/share# make &amp;&amp; make install</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;也可以打成RPM包，然后安装。</p>
<h2 id="说明"><a href="#说明" class="headerlink" title="说明"></a>说明</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;用到的HA场景如下： 两台主机host113和host163，内网IP在eth1网卡上，分别是10.210.214.113和10.210.214.163，VIP为公网IP在eth0上，IP地址是202.102.152.253，网关为202.102.152.1。当VIP在host113上提供服务时，host113上的默认路由为202.102.152.1，提供服务的端口为202.102.152.253:443。host113发生故障需要将VIP及服务切回到host163上的时候，需要以下几步，第一将VIP接管过来，第二添加默认路由202.102.152.1，第三启动在端口202.102.152.253:443上的服务。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;如此一来，keepalived需要另外的脚本来完成添加默认路由和启动服务工作，这点和heartbeat中的resources是相同的。目前我进行了测试，发现keepalived速度要比heartbeat快，也就是说效率比heartbeat高。并且，最重要的一点，keepalived支持多个backup。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;不要问为何有以上需求。要为两个不同的域名提供https服务，由于SSL证书问题，必须有两个公网IP地址分别绑定443端口。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当然，通过SNI也可以实现一个公网IP绑定443端口来为多个域名提供https服务，但是这需要浏览器支持（M$的IE浏览器不支持）。（nginx/apache）</p>
<h2 id="吐槽"><a href="#吐槽" class="headerlink" title="吐槽"></a>吐槽</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;keepalived的主从切换比较让人蛋疼，需要修改配置文件或停止一方的运行。但是由于keepalived是通过vrrp协议来实现failover（故障转移）的，因此也决定了手动主从切换的不便。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;keepalived的文档也很旧了，一直都找不到合适的文档，之我就一直忽略了vrrp_script这个区域，导致很多事情想不通。</p>
<p>参考资料</p>
<ol>
<li><a href="http://www.linuxvirtualserver.org/" target="_blank" rel="external">http://www.linuxvirtualserver.org/</a></li>
<li><a href="http://www.keepalived.org/LVS-NAT-Keepalived-HOWTO.html" target="_blank" rel="external">http://www.keepalived.org/LVS-NAT-Keepalived-HOWTO.html</a></li>
</ol>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/7. keepalived 和 lvs 的结合配置文件详解/">keepalived 和 lvs 的结合配置文件详解</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a> <a class="article__tag-link" href="/tags/keepalived/">keepalived</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;/export/servers/keepalived/conf/keepalived.conf配置文件详解：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div><div class="line">53</div><div class="line">54</div><div class="line">55</div><div class="line">56</div><div class="line">57</div><div class="line">58</div><div class="line">59</div><div class="line">60</div><div class="line">61</div><div class="line">62</div><div class="line">63</div><div class="line">64</div><div class="line">65</div><div class="line">66</div><div class="line">67</div><div class="line">68</div><div class="line">69</div><div class="line">70</div></pre></td><td class="code"><pre><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line"><span class="comment">#全局配置</span></div><div class="line">global_defs &#123;</div><div class="line">notification_email &#123; <span class="comment">#设置报警邮件地址，每行一个，（如何要开启邮件报警，需要开启本机的sendmail服务）</span></div><div class="line">lihuiyw@jd.com</div><div class="line">&#125;</div><div class="line">notification_email_from lihuiyw@jd.com <span class="comment">#设置邮件的发送地址</span></div><div class="line">smtp_server mail.jd.com <span class="comment">#设置邮件的smtp server地址</span></div><div class="line">smtp_connect_timeout 30 <span class="comment">#设置连接smtp server的超时时间</span></div><div class="line">router_id LVS_DEVEL <span class="comment">#表示keepalived服务器的一个标识，是发邮件时显示在邮件主题中的信息</span></div><div class="line">&#125;</div><div class="line"><span class="comment">#keepalived的VRRPD配置，是所有keepalived配置的核心</span></div><div class="line"><span class="comment">#VRRP实例配置</span></div><div class="line">vrrp_instance VIP_142 <span class="comment">#是VRRP实例开始的标识，后跟VRRP实例名称</span></div><div class="line">&#123;</div><div class="line">state MASTER <span class="comment">#keepalived的角色，MASTER主，BACKUP备</span></div><div class="line">interface eth0 <span class="comment">#用于指定HA监测网络的接口</span></div><div class="line">virtual_router_id 142 <span class="comment">#虚拟路由标识，这个标识是一个数字，同一个VRRP实例使用唯一的一个标识，即在同一个vrrp_instance下，MASTER和BACKUP必须是一致的！</span></div><div class="line">priority 100 <span class="comment">#权重优先级</span></div><div class="line">advert_int 2 <span class="comment">#用于设定master和backup主机之间同步检查的时间间隔，单位是秒</span></div><div class="line">garp_master_delay 10 <span class="comment">#用于切换到master状态后延时进行Gratuitous arp请求的时间</span></div><div class="line">smtp_alert <span class="comment">#表示是否开启邮件通知(用全局区域的邮件设置来发通知)</span></div><div class="line">authentication <span class="comment">#主备之间进行通信的验证类型和密码：验证类型主要有PASS和AH两种，一个在vrrp_instance下，MASTER和backup必须使用相同的密码才可以通信</span></div><div class="line">&#123;</div><div class="line">auth_type PASS</div><div class="line">auth_pass 123456</div><div class="line">&#125;</div><div class="line"><span class="comment">#virtual_ipaddress用于设置虚拟ip地址，可以设置多个vip，每行一个，</span></div><div class="line">virtual_ipaddress</div><div class="line">&#123;</div><div class="line">10.95.0.200/24</div><div class="line">&#125;</div><div class="line">track_interface <span class="comment">#用于设置一些额外的网络监控接口，其中任何一个网络接口出现故障，keepalived都会进去fault状态！</span></div><div class="line">&#123;</div><div class="line">eth0</div><div class="line">&#125;</div><div class="line">nopreempt <span class="comment">#设置不抢占功能，只能在backup上使用，知道机器有故障了才切换，</span></div><div class="line">preemtp_delay 300 <span class="comment">#用于设置抢占的延时时间，（例：开启启动没必要抢占）</span></div><div class="line">&#125;</div><div class="line"><span class="comment">#以下是lvs的主要主要配置信息，主要实现lvs的ip包转发功能！</span></div><div class="line">virtual_server 10.95.0.200 80 <span class="comment">#虚拟ip和端口</span></div><div class="line">&#123;</div><div class="line">delay_loop 6 <span class="comment">#设置健康检查的时间间隔</span></div><div class="line">lb_algo wrr <span class="comment">#设置负载调度算法</span></div><div class="line">lb_kind DR <span class="comment">#设置lvs的模式</span></div><div class="line">persistence_timeout 60 <span class="comment">#会话保持时间，单位秒</span></div><div class="line">protocol TCP <span class="comment">#ip包转发协议，有TCP和UDP两种</span></div><div class="line">real_server 10.95.0.143 80 <span class="comment">#real server 的ip</span></div><div class="line">&#123;</div><div class="line">weight 3 <span class="comment">#权重</span></div><div class="line">TCP_CHECK <span class="comment">#健康检查</span></div><div class="line">&#123;</div><div class="line">connect_timeout 10 <span class="comment">#表示无响应超时时间</span></div><div class="line">nb_get_retry 3 <span class="comment">#表示重连次数</span></div><div class="line">delay_before_retry 3 <span class="comment">#表示重试间隔</span></div><div class="line">connect_port 80 <span class="comment">#表示端口</span></div><div class="line">&#125;</div><div class="line">&#125;</div><div class="line">real_server 10.95.0.144 80</div><div class="line">&#123;</div><div class="line">weight 3</div><div class="line">TCP_CHECK</div><div class="line">&#123;</div><div class="line">connect_timeout 10</div><div class="line">nb_get_retry 3</div><div class="line">delay_before_retry 3</div><div class="line">connect_port 80</div><div class="line">&#125;</div><div class="line">&#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;健康监测应许多种检查方式，常见的有，HTTP_GET，SSL_GET，TCP_CHECK，SMTP_CHECK，MISC_CHECK.</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">TCP_CHECK &#123;</div><div class="line">conetct_port 80</div><div class="line">connect_timeout 3</div><div class="line">nb_get_retry 3</div><div class="line">delay_before_retry 3</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;connect_port:健康检查的端口，如果不指定，默认是real_server指定的端口</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;connect_timeout:表示无响应超时时间，单位是秒，这里是3s</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;nb_get_retry：表示重试次数，这里是3ci</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;delay_before_retry：表示重试间隔，</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div></pre></td><td class="code"><pre><div class="line">HTTP_GET |SSL_GET</div><div class="line">&#123;</div><div class="line">url&#123;</div><div class="line">path /index.html <span class="comment">#指定url信息</span></div><div class="line">digest e6owjfdsjfalsjdfsalkf30wfdsfjwqe</div><div class="line"><span class="comment">#ssl检查后的摘要信息，这些摘要信息可以通过genhash命令工具获取，</span></div><div class="line"><span class="comment">#例：genhash -s 192.168.12.80 -p 80 -u /index.html</span></div><div class="line">status_code 200</div><div class="line">&#125;</div><div class="line">connect_port 80</div><div class="line">bindto 192.168.31.128 <span class="comment">#表示通过此地址来对发送请求对服务器进行健康检查</span></div><div class="line">nb_get_retry 3</div><div class="line">delay_before_retry 2</div><div class="line"></div><div class="line">&#125;</div></pre></td></tr></table></figure>
	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/5. keepalived 的启动脚本和安装脚本/">keepalived 的启动脚本和安装脚本 的结合配置文件详解</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a> <a class="article__tag-link" href="/tags/keepalived/">keepalived</a>
			</span>
		
	</div>

	

	
		<h2 id="keepalived-的启动脚本"><a href="#keepalived-的启动脚本" class="headerlink" title="keepalived 的启动脚本"></a>keepalived 的启动脚本</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div><div class="line">53</div><div class="line">54</div><div class="line">55</div><div class="line">56</div><div class="line">57</div><div class="line">58</div><div class="line">59</div><div class="line">60</div><div class="line">61</div><div class="line">62</div><div class="line">63</div><div class="line">64</div><div class="line">65</div><div class="line">66</div><div class="line">67</div><div class="line">68</div><div class="line">69</div><div class="line">70</div><div class="line">71</div><div class="line">72</div><div class="line">73</div><div class="line">74</div><div class="line">75</div><div class="line">76</div><div class="line">77</div><div class="line">78</div><div class="line">79</div><div class="line">80</div><div class="line">81</div><div class="line">82</div><div class="line">83</div><div class="line">84</div><div class="line">85</div><div class="line">86</div><div class="line">87</div><div class="line">88</div><div class="line">89</div><div class="line">90</div><div class="line">91</div><div class="line">92</div><div class="line">93</div><div class="line">94</div><div class="line">95</div><div class="line">96</div><div class="line">97</div><div class="line">98</div><div class="line">99</div><div class="line">100</div><div class="line">101</div><div class="line">102</div><div class="line">103</div><div class="line">104</div><div class="line">105</div><div class="line">106</div><div class="line">107</div><div class="line">108</div><div class="line">109</div><div class="line">110</div><div class="line">111</div><div class="line">112</div><div class="line">113</div><div class="line">114</div><div class="line">115</div><div class="line">116</div><div class="line">117</div><div class="line">118</div><div class="line">119</div><div class="line">120</div><div class="line">121</div><div class="line">122</div><div class="line">123</div><div class="line">124</div><div class="line">125</div><div class="line">126</div><div class="line">127</div><div class="line">128</div><div class="line">129</div><div class="line">130</div><div class="line">131</div><div class="line">132</div><div class="line">133</div><div class="line">134</div><div class="line">135</div><div class="line">136</div><div class="line">137</div><div class="line">138</div><div class="line">139</div><div class="line">140</div><div class="line">141</div><div class="line">142</div><div class="line">143</div><div class="line">144</div><div class="line">145</div><div class="line">146</div><div class="line">147</div><div class="line">148</div><div class="line">149</div><div class="line">150</div><div class="line">151</div><div class="line">152</div><div class="line">153</div><div class="line">154</div><div class="line">155</div><div class="line">156</div><div class="line">157</div><div class="line">158</div><div class="line">159</div><div class="line">160</div><div class="line">161</div></pre></td><td class="code"><pre><div class="line"><span class="meta">#!/bin/sh</span></div><div class="line"><span class="comment">#</span></div><div class="line"><span class="comment"># Startup script for the Keepalived daemon</span></div><div class="line"><span class="comment">#</span></div><div class="line"><span class="comment"># processname: keepalived</span></div><div class="line"><span class="comment"># pidfile: /var/run/keepalived.pid</span></div><div class="line"><span class="comment"># config: /etc/keepalived/keepalived.conf</span></div><div class="line"><span class="comment"># chkconfig: - 21 79</span></div><div class="line"><span class="comment"># description: Start and stop Keepalived</span></div><div class="line"></div><div class="line">. /etc/init.d/<span class="built_in">functions</span></div><div class="line"></div><div class="line"><span class="comment"># Source configuration file (we set KEEPALIVED_OPTIONS there)</span></div><div class="line"><span class="comment">#. /etc/sysconfig/keepalived</span></div><div class="line">KEEP_CONF=<span class="string">"/export/servers/keepalived-1.2.13/conf/keepalived.conf"</span></div><div class="line">KEEP_SBIN=<span class="string">"/export/servers/keepalived-1.2.13/sbin/keepalived"</span></div><div class="line">KEEP_PID=<span class="string">"/var/run/keepalived.pid "</span></div><div class="line"></div><div class="line">RETVAL=0</div><div class="line"></div><div class="line">prog=<span class="string">"keepalived"</span></div><div class="line"></div><div class="line"><span class="function"><span class="title">start</span></span>() &#123;</div><div class="line">    <span class="built_in">echo</span> -n $<span class="string">"Starting <span class="variable">$prog</span>: "</span></div><div class="line">    daemon <span class="variable">$KEEP_SBIN</span> --use-file=<span class="variable">$KEEP_CONF</span></div><div class="line">    RETVAL=$?</div><div class="line">    <span class="built_in">echo</span></div><div class="line">    <span class="built_in">return</span> <span class="variable">$RETVAL</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="function"><span class="title">stop</span></span>() &#123;</div><div class="line">    <span class="built_in">echo</span> -n $<span class="string">"Stopping <span class="variable">$prog</span>: "</span></div><div class="line">    killproc -p <span class="variable">$KEEP_PID</span> <span class="variable">$KEEP_SBIN</span> -TERM</div><div class="line">    RETVAL=$?</div><div class="line">    <span class="built_in">echo</span></div><div class="line">    <span class="comment">#[ $RETVAL -eq 0 ] &amp;&amp; rm -f /var/lock/subsys/$prog</span></div><div class="line">    <span class="built_in">return</span> <span class="variable">$RETVAL</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="function"><span class="title">reload</span></span>() &#123;</div><div class="line">    <span class="built_in">echo</span> -n $<span class="string">"Reloading <span class="variable">$prog</span>: "</span></div><div class="line">    <span class="comment">#killproc keepalived -1</span></div><div class="line">    killproc -p <span class="variable">$KEEP_PID</span> <span class="variable">$KEEP_SBIN</span> -HUP</div><div class="line">    RETVAL=$?</div><div class="line">    <span class="built_in">echo</span></div><div class="line">    <span class="built_in">return</span> <span class="variable">$RETVAL</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="comment"># See how we were called.</span></div><div class="line"><span class="keyword">case</span> <span class="string">"<span class="variable">$1</span>"</span> <span class="keyword">in</span></div><div class="line">    start)</div><div class="line">        start</div><div class="line">        ;;</div><div class="line">    stop)</div><div class="line">        stop</div><div class="line">        ;;</div><div class="line">    reload)</div><div class="line">        reload</div><div class="line">        ;;</div><div class="line">    restart)</div><div class="line">        stop</div><div class="line">        start</div><div class="line">        ;;</div><div class="line">    condrestart)</div><div class="line">        <span class="keyword">if</span> [ -f /var/lock/subsys/<span class="variable">$prog</span> ]; <span class="keyword">then</span></div><div class="line">            stop</div><div class="line">            start</div><div class="line">        <span class="keyword">fi</span></div><div class="line">        ;;</div><div class="line">    status)</div><div class="line">        status keepalived</div><div class="line">        RETVAL=$?</div><div class="line">        ;;</div><div class="line">    *)</div><div class="line">        <span class="built_in">echo</span> <span class="string">"Usage: <span class="variable">$0</span> &#123;start|stop|reload|restart|condrestart|status&#125;"</span></div><div class="line">        RETVAL=1</div><div class="line"><span class="keyword">esac</span></div><div class="line"></div><div class="line"><span class="built_in">exit</span> <span class="variable">$RETVAL</span></div><div class="line">=======</div><div class="line"><span class="meta">#!/bin/sh</span></div><div class="line"><span class="comment">#</span></div><div class="line"><span class="comment"># Startup script for the Keepalived daemon</span></div><div class="line"><span class="comment">#</span></div><div class="line"><span class="comment"># processname: keepalived</span></div><div class="line"><span class="comment"># pidfile: /var/run/keepalived.pid</span></div><div class="line"><span class="comment"># config: /etc/keepalived/keepalived.conf</span></div><div class="line"><span class="comment"># chkconfig: - 21 79</span></div><div class="line"><span class="comment"># description: Start and stop Keepalived</span></div><div class="line"></div><div class="line"><span class="comment"># Source function library</span></div><div class="line">. /etc/init.d/<span class="built_in">functions</span></div><div class="line"></div><div class="line"><span class="comment"># Source configuration file (we set KEEPALIVED_OPTIONS there)</span></div><div class="line"><span class="comment">#. /etc/sysconfig/keepalived</span></div><div class="line">KEEP_CONF=<span class="string">"/export/servers/keepalived-1.2.13/conf/keepalived.conf"</span></div><div class="line">KEEP_SBIN=<span class="string">"/export/servers/keepalived-1.2.13/sbin/keepalived"</span></div><div class="line">KEEP_PID=<span class="string">"/var/run/keepalived.pid "</span></div><div class="line"></div><div class="line">RETVAL=0</div><div class="line"></div><div class="line">prog=<span class="string">"keepalived"</span></div><div class="line"></div><div class="line"><span class="function"><span class="title">start</span></span>() &#123;</div><div class="line">    <span class="built_in">echo</span> -n $<span class="string">"Starting <span class="variable">$prog</span>: "</span></div><div class="line">    daemon <span class="variable">$KEEP_SBIN</span> --use-file=<span class="variable">$KEEP_CONF</span></div><div class="line">    RETVAL=$?</div><div class="line">    <span class="built_in">echo</span></div><div class="line">    <span class="built_in">return</span> <span class="variable">$RETVAL</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="function"><span class="title">stop</span></span>() &#123;</div><div class="line">    <span class="built_in">echo</span> -n $<span class="string">"Stopping <span class="variable">$prog</span>: "</span></div><div class="line">    killproc -p <span class="variable">$KEEP_PID</span> <span class="variable">$KEEP_SBIN</span> -TERM</div><div class="line">    RETVAL=$?</div><div class="line">    <span class="built_in">echo</span></div><div class="line">    <span class="comment">#[ $RETVAL -eq 0 ] &amp;&amp; rm -f /var/lock/subsys/$prog</span></div><div class="line">    <span class="built_in">return</span> <span class="variable">$RETVAL</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="function"><span class="title">reload</span></span>() &#123;</div><div class="line">    <span class="built_in">echo</span> -n $<span class="string">"Reloading <span class="variable">$prog</span>: "</span></div><div class="line">    <span class="comment">#killproc keepalived -1</span></div><div class="line">    killproc -p <span class="variable">$KEEP_PID</span> <span class="variable">$KEEP_SBIN</span> -HUP</div><div class="line">    RETVAL=$?</div><div class="line">    <span class="built_in">echo</span></div><div class="line">    <span class="built_in">return</span> <span class="variable">$RETVAL</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="comment"># See how we were called.</span></div><div class="line"><span class="keyword">case</span> <span class="string">"<span class="variable">$1</span>"</span> <span class="keyword">in</span></div><div class="line">    start)</div><div class="line">        start</div><div class="line">        ;;</div><div class="line">    stop)</div><div class="line">        stop</div><div class="line">        ;;</div><div class="line">    reload)</div><div class="line">        reload</div><div class="line">        ;;</div><div class="line">    restart)</div><div class="line">        stop</div><div class="line">        start</div><div class="line">        ;;</div><div class="line">    condrestart)</div><div class="line">        <span class="keyword">if</span> [ -f /var/lock/subsys/<span class="variable">$prog</span> ]; <span class="keyword">then</span></div><div class="line">            stop</div><div class="line">            start</div><div class="line">        <span class="keyword">fi</span></div><div class="line">        ;;</div><div class="line">    status)</div><div class="line">        status keepalived</div><div class="line">        RETVAL=$?</div><div class="line">        ;;</div><div class="line">    *)</div><div class="line">        <span class="built_in">echo</span> <span class="string">"Usage: <span class="variable">$0</span> &#123;start|stop|reload|restart|condrestart|status&#125;"</span></div><div class="line">        RETVAL=1</div><div class="line"><span class="keyword">esac</span></div><div class="line"></div><div class="line"><span class="built_in">exit</span> <span class="variable">$RETVAL</span></div><div class="line">&gt;&gt;&gt;&gt;&gt;&gt;&gt; .r3360</div></pre></td></tr></table></figure>
<h2 id="keepalived-的安装脚本"><a href="#keepalived-的安装脚本" class="headerlink" title="keepalived 的安装脚本"></a>keepalived 的安装脚本</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div><div class="line">52</div><div class="line">53</div><div class="line">54</div><div class="line">55</div><div class="line">56</div><div class="line">57</div><div class="line">58</div><div class="line">59</div><div class="line">60</div><div class="line">61</div><div class="line">62</div><div class="line">63</div><div class="line">64</div><div class="line">65</div><div class="line">66</div><div class="line">67</div><div class="line">68</div><div class="line">69</div><div class="line">70</div><div class="line">71</div><div class="line">72</div><div class="line">73</div><div class="line">74</div><div class="line">75</div><div class="line">76</div><div class="line">77</div><div class="line">78</div><div class="line">79</div><div class="line">80</div><div class="line">81</div><div class="line">82</div><div class="line">83</div><div class="line">84</div><div class="line">85</div><div class="line">86</div><div class="line">87</div><div class="line">88</div><div class="line">89</div><div class="line">90</div><div class="line">91</div><div class="line">92</div><div class="line">93</div><div class="line">94</div><div class="line">95</div><div class="line">96</div><div class="line">97</div><div class="line">98</div><div class="line">99</div><div class="line">100</div><div class="line">101</div><div class="line">102</div><div class="line">103</div><div class="line">104</div><div class="line">105</div><div class="line">106</div><div class="line">107</div><div class="line">108</div><div class="line">109</div><div class="line">110</div><div class="line">111</div><div class="line">112</div><div class="line">113</div><div class="line">114</div><div class="line">115</div><div class="line">116</div><div class="line">117</div><div class="line">118</div><div class="line">119</div><div class="line">120</div><div class="line">121</div><div class="line">122</div><div class="line">123</div><div class="line">124</div><div class="line">125</div><div class="line">126</div><div class="line">127</div><div class="line">128</div><div class="line">129</div><div class="line">130</div><div class="line">131</div><div class="line">132</div><div class="line">133</div><div class="line">134</div><div class="line">135</div><div class="line">136</div><div class="line">137</div><div class="line">138</div><div class="line">139</div><div class="line">140</div><div class="line">141</div><div class="line">142</div><div class="line">143</div><div class="line">144</div><div class="line">145</div><div class="line">146</div><div class="line">147</div><div class="line">148</div><div class="line">149</div><div class="line">150</div></pre></td><td class="code"><pre><div class="line"><span class="meta">#!/bin/bash</span></div><div class="line">role=<span class="variable">$1</span></div><div class="line">weight=<span class="variable">$2</span></div><div class="line">vip=<span class="variable">$3</span></div><div class="line"><span class="comment">#routerid=`ifconfig |grep Bcast|cut -d: -f2|awk '&#123;print $1&#125;'|awk -F. '&#123;print $4&#125;'`</span></div><div class="line">routerid=<span class="variable">$4</span></div><div class="line">interface=`ifconfig | awk -F<span class="string">"     "</span> <span class="string">'&#123;print $1&#125;'</span> | grep -v lo | grep -v ^\s*$`</div><div class="line"><span class="comment">#vrrd_id=`ifconfig |grep "inet addr"|grep -v "127.0.0.1"|awk -F: '&#123;print $2&#125;'|awk '&#123;print $1&#125;'|awk -F. '&#123;print $4&#125;'`</span></div><div class="line">keep_dir=/<span class="built_in">export</span>/servers/keepalived-1.2.13</div><div class="line">conf_dir=<span class="variable">$keep_dir</span>/conf</div><div class="line">pid_dir=<span class="variable">$keep_dir</span>/pid</div><div class="line">sh_dir=/<span class="built_in">export</span>/sh</div><div class="line">WHO=`whoami`</div><div class="line"><span class="keyword">function</span> <span class="built_in">help</span>()</div><div class="line">&#123;</div><div class="line">	<span class="built_in">echo</span> -e <span class="string">"Install Tips:#Such as master安装 sh <span class="variable">$0</span> MASTER 100 vip routerid # BACKUP安装 sh <span class="variable">$0</span> BACKUP [LESS THEN 100] vip routerid"</span></div><div class="line">&#125;</div><div class="line"><span class="keyword">if</span> [ <span class="variable">$#</span> -eq 0 ]</div><div class="line"><span class="keyword">then</span></div><div class="line">	<span class="built_in">help</span></div><div class="line">	<span class="built_in">exit</span> 1</div><div class="line"><span class="keyword">fi</span></div><div class="line"><span class="comment">########检查网络，安装popt包</span></div><div class="line"><span class="built_in">echo</span> -e <span class="string">"\033[;37;32mCheckNetwork\033[0m"</span></div><div class="line"><span class="keyword">if</span> ! ping -c 1 -w 1 172.22.197.62 &gt; /dev/null; <span class="keyword">then</span></div><div class="line">      <span class="built_in">echo</span> -e <span class="string">"\033[;37;31mPlease Check Network Before Setup\033[0m"</span>;</div><div class="line">      <span class="built_in">exit</span> 1;</div><div class="line"><span class="keyword">else</span> </div><div class="line">      <span class="built_in">echo</span> -e <span class="string">"\033[;37;32mOK\033[0m"</span>;</div><div class="line"><span class="keyword">fi</span></div><div class="line"><span class="built_in">echo</span> -e <span class="string">"\033[;37;32mStarting Yum\033[0m"</span></div><div class="line">yum -y install popt-devel openssl openssl-devel make openssl-devel popt popt-devel libnl-devel kernel-devel</div><div class="line"><span class="built_in">echo</span> -e <span class="string">"\033[;37;32mYum Install Done\033[0m"</span></div><div class="line"><span class="comment">####download and install keepalived-1.2.13.tar.gz</span></div><div class="line"><span class="built_in">cd</span> /usr/<span class="built_in">local</span>/src/keepalived</div><div class="line"><span class="keyword">if</span> [ ! -e keepalived-1.2.13.tar.gz ]</div><div class="line"><span class="keyword">then</span></div><div class="line">	wget http://172.22.197.62/CentOS/app/keepalived-1.2.13.tar.gz</div><div class="line">	tar xzf keepalived-1.2.13.tar.gz</div><div class="line"><span class="keyword">else</span></div><div class="line">	tar xzf keepalived-1.2.13.tar.gz</div><div class="line"><span class="keyword">fi</span></div><div class="line">rpm -ivh popt-static-1.13-7.el6.x86_64.rpm</div><div class="line"><span class="built_in">cd</span> keepalived-1.2.13</div><div class="line">./configure --prefix=/<span class="built_in">export</span>/servers/keepalived-1.2.13 --sysconfdir=/<span class="built_in">export</span>/servers/keepalived-1.2.13/etc/ --bindir=/<span class="built_in">export</span>/servers/keepalived-1.2.13/bin/ --with-kernel-dir=/usr/src/linux/</div><div class="line">make &amp;&amp; make install</div><div class="line"><span class="keyword">if</span> [ $? -eq 0 ]</div><div class="line">	<span class="keyword">then</span></div><div class="line">		<span class="built_in">echo</span> <span class="string">"make success"</span></div><div class="line">	<span class="keyword">else</span></div><div class="line">		<span class="built_in">echo</span> <span class="string">"make error"</span></div><div class="line">	  <span class="built_in">exit</span> 1</div><div class="line"><span class="keyword">fi</span></div><div class="line">cp /<span class="built_in">export</span>/servers/keepalived-1.2.13/sbin/keepalived /usr/sbin/</div><div class="line">cp /<span class="built_in">export</span>/servers/keepalived-1.2.13/etc/sysconfig/keepalived /etc/sysconfig/</div><div class="line">cp ../keepalived /etc/init.d/</div><div class="line">chmod +x /etc/init.d/keepalived</div><div class="line">chkconfig --add keepalived</div><div class="line">chkconfig keepalived on</div><div class="line"><span class="built_in">echo</span> -e <span class="string">"\033[;37;32m创建keepalive配置文件路径\033[0m"</span></div><div class="line">mkdir -p <span class="variable">$conf_dir</span></div><div class="line"><span class="comment">#######添加keepalive配置文件</span></div><div class="line">cat &gt; <span class="variable">$conf_dir</span>/keepalived.conf &lt;&lt;EOF</div><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line"></div><div class="line">global_defs &#123;</div><div class="line">   notification_email &#123;</div><div class="line">      lihuiyw@jd.com   </div><div class="line">&#125;</div><div class="line">   notification_email_from lihuiyw@jd.com</div><div class="line">   smtp_server mail.jd.com</div><div class="line">   smtp_connect_timeout 30</div><div class="line">   router_id LVS_DEVEL</div><div class="line">&#125;</div><div class="line">vrrp_script check_alive</div><div class="line">&#123;</div><div class="line">        script <span class="string">"/export/sh/check_nginx_alive.sh"</span></div><div class="line">        <span class="comment"># check every 2 seconds</span></div><div class="line">        interval 2</div><div class="line">        <span class="comment"># if failed, decrease 10 of the priority</span></div><div class="line">        weight -10</div><div class="line">        <span class="comment"># require 2 failures for failures</span></div><div class="line">        fail 2</div><div class="line">        <span class="comment"># require 1 sucesses for ok</span></div><div class="line">        rise 1</div><div class="line">&#125;</div><div class="line">vrrp_instance VIP_<span class="variable">$&#123;routerid&#125;</span></div><div class="line">&#123;</div><div class="line">	state <span class="variable">$role</span></div><div class="line">	interface <span class="variable">$interface</span></div><div class="line">	virtual_router_id <span class="variable">$routerid</span></div><div class="line">	priority <span class="variable">$weight</span></div><div class="line">	advert_int 2 </div><div class="line">	garp_master_delay 10</div><div class="line">	smtp_alert</div><div class="line"></div><div class="line">	authentication</div><div class="line">	&#123;</div><div class="line">		auth_type PASS </div><div class="line">		auth_pass 123456</div><div class="line">	&#125;</div><div class="line">	virtual_ipaddress</div><div class="line">	&#123; </div><div class="line">		<span class="variable">$&#123;vip&#125;</span>/24</div><div class="line">	&#125;</div><div class="line">	track_interface </div><div class="line">	&#123;</div><div class="line">		<span class="variable">$interface</span></div><div class="line">	&#125; </div><div class="line">	track_script</div><div class="line">	&#123; </div><div class="line">		check_alive </div><div class="line">	&#125;</div><div class="line">&#125;</div><div class="line">EOF</div><div class="line"><span class="comment">###########监控keepalived脚本、脚本需要放到同keepalived配置文件指定路径</span></div><div class="line"><span class="built_in">echo</span> -e <span class="string">"\033[;37;32m创建脚本路径\033[0m"</span></div><div class="line">mkdir -p <span class="variable">$sh_dir</span> <span class="variable">$pid_dir</span></div><div class="line">cat &gt; <span class="variable">$sh_dir</span>/check_nginx_alive.sh &lt;&lt; EOF</div><div class="line"><span class="meta">#!/bin/bash</span></div><div class="line"><span class="comment">#监控脚本功能概述：</span></div><div class="line"><span class="comment">#首先检查进程中的nginx进程数目，如果不存在（即为0）,则表示nginx未开启，然后开启nginx。</span></div><div class="line"><span class="comment">#3秒后重新检查nginx进程数，若仍为0，则表示nginx无法正常启动，此时强制停止keepalived进程，让虚拟ip切换到backup服务器上</span></div><div class="line"></div><div class="line"><span class="comment">## 如果没有nginx进程，即值为零</span></div><div class="line"><span class="comment">#echo \`pgrep -l nginx\`</span></div><div class="line"><span class="comment">#echo \`ps -ef | grep nginx\`</span></div><div class="line"></div><div class="line"><span class="keyword">if</span> [ \`pgrep <span class="string">"^nginx"</span> | wc -l\` -eq 0 ]</div><div class="line"><span class="keyword">then</span></div><div class="line">	service nginx start	</div><div class="line"></div><div class="line">	sleep 1</div><div class="line"></div><div class="line">	<span class="keyword">if</span> [ \`pgrep <span class="string">"^nginx"</span> | wc -l\` -eq 0 ]</div><div class="line">	<span class="keyword">then</span></div><div class="line">		<span class="comment">## 则结束 keepalived 进程，使得服务器切换到BACKUP服务器上</span></div><div class="line">		service keepalived stop</div><div class="line">	<span class="keyword">fi</span></div><div class="line"><span class="keyword">fi</span></div><div class="line">EOF</div><div class="line"><span class="built_in">echo</span> -e <span class="string">"\033[;37;32m赋可执行权限\033[0m"</span></div><div class="line">chown -R admin.admin <span class="variable">$conf_dir</span> <span class="variable">$keep_dir</span> <span class="variable">$sh_dir</span></div><div class="line"><span class="comment">#chmod 777 $sh_dir/check_nginx_alive.sh</span></div><div class="line">/<span class="built_in">export</span>/servers/keepalived-1.2.13/sbin/keepalived --use-file=/<span class="built_in">export</span>/servers/keepalived-1.2.13/conf/keepalived.conf</div><div class="line">&gt;/home/install_keepalived.log</div><div class="line"><span class="keyword">if</span> [ $? -eq 0 ]</div><div class="line">	<span class="keyword">then</span></div><div class="line">		<span class="built_in">echo</span> <span class="string">"keepalived install done"</span></div><div class="line"><span class="keyword">fi</span></div></pre></td></tr></table></figure>
	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/4. keepalived 单独配置文件/">keepalived 单独配置文件</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a> <a class="article__tag-link" href="/tags/keepalived/">keepalived</a>
			</span>
		
	</div>

	

	
		<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div><div class="line">49</div><div class="line">50</div><div class="line">51</div></pre></td><td class="code"><pre><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line"></div><div class="line">global_defs &#123;</div><div class="line">   notification_email &#123;</div><div class="line">      lihuiyw@jd.com   </div><div class="line">&#125;</div><div class="line">   notification_email_from lihuiyw@jd.com</div><div class="line">   smtp_server mail.jd.com</div><div class="line">   smtp_connect_timeout 30</div><div class="line">   router_id LVS_DEVEL</div><div class="line">&#125;</div><div class="line">vrrp_script check_alive</div><div class="line">&#123;</div><div class="line">        script <span class="string">"/export/sh/check_nginx_alive.sh"</span></div><div class="line">        <span class="comment"># check every 2 seconds</span></div><div class="line">        interval 2</div><div class="line">        <span class="comment"># if failed, decrease 10 of the priority</span></div><div class="line">        weight -10</div><div class="line">        <span class="comment"># require 2 failures for failures</span></div><div class="line">        fail 2</div><div class="line">        <span class="comment"># require 1 sucesses for ok</span></div><div class="line">        rise 1</div><div class="line">&#125;</div><div class="line">vrrp_instance VIP_<span class="variable">$&#123;routerid&#125;</span></div><div class="line">&#123;</div><div class="line">	state <span class="variable">$role</span></div><div class="line">	interface <span class="variable">$interface</span></div><div class="line">	virtual_router_id <span class="variable">$routerid</span></div><div class="line">	priority <span class="variable">$weight</span></div><div class="line">	advert_int 2 </div><div class="line">	garp_master_delay 10</div><div class="line">	smtp_alert</div><div class="line"></div><div class="line">	authentication</div><div class="line">	&#123;</div><div class="line">		auth_type PASS </div><div class="line">		auth_pass 123456</div><div class="line">	&#125;</div><div class="line">	virtual_ipaddress</div><div class="line">	&#123; </div><div class="line">		<span class="variable">$&#123;vip&#125;</span>/24</div><div class="line">	&#125;</div><div class="line">	track_interface </div><div class="line">	&#123;</div><div class="line">		<span class="variable">$interface</span></div><div class="line">	&#125; </div><div class="line">	track_script</div><div class="line">	&#123; </div><div class="line">		check_alive </div><div class="line">	&#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/3. LVS 负载均衡 fullnat 模式和 nat 模式的区别/">LVS 负载均衡 fullnat 模式和 nat 模式的区别</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;关于LVS和FULLNAT的介绍可以看一下 <a href="http://blog.aliyun.com/1750" target="_blank" rel="external">淘宝吴佳明(普空)的视频</a> ，FULLNAT 模式很大简化了LVS的配置和部署，目前淘宝和百度基本上都在使用FULLNAT模式来作为接入侧的负载均衡模式.</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;百度的LVS叫做BVS, Baidu Virtual Server, 是在LVS基础上修改的增加了L3 Though 和 SYN Porxy，貌似也是吴佳明(普空)在百度搞的, 类似FULLNAT 项目.</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;下面的图来自吴佳明(普空)的PPT, 自己重画了一遍，关于NAT和FULLNAT的区别如下图所示：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%20%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%20fullnat%20%E6%A8%A1%E5%BC%8F%E5%92%8C%20nat%20%E6%A8%A1%E5%BC%8F%E7%9A%84%E5%8C%BA%E5%88%AB/01.png?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;看完上图后发现 FULLNAT有一个问题是：RealServer无法获得用户IP；淘宝通过叫TOA的方式解决的，</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;主要原理是：将 client address 放到了TCP Option 里面带给后端RealServer，RealServer 收到后保存在 socket 的结构体里并通过toa内核模块 hook 了 getname 函数，这样当用户调用 getname 获取远端地址时，返回的是保存在 socket 的 TCPOption 的 IP . 百度的 BVS 是通过叫 ttm 模块实现的，其实现方式跟 toa 基本一样，只是没有开源.</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;实现原理图如下：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%20%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%20fullnat%20%E6%A8%A1%E5%BC%8F%E5%92%8C%20nat%20%E6%A8%A1%E5%BC%8F%E7%9A%84%E5%8C%BA%E5%88%AB/03.png?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;下面看下上面说的逻辑的实现<a href="https://github.com/alibaba/LVS" target="_blank" rel="external">代码</a></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;lvs侧在TCP报文的选项中插入clientip代码: tcp_fnat_in_handler()</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%20%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%20fullnat%20%E6%A8%A1%E5%BC%8F%E5%92%8C%20nat%20%E6%A8%A1%E5%BC%8F%E7%9A%84%E5%8C%BA%E5%88%AB/04.png?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;RS 侧收到建连报文时，取出 toa 里面的 client ip 和 port  存放在 socket 的 use_data 里, toa.c</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%20%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%20fullnat%20%E6%A8%A1%E5%BC%8F%E5%92%8C%20nat%20%E6%A8%A1%E5%BC%8F%E7%9A%84%E5%8C%BA%E5%88%AB/05.png?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;HOOK挂载：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%20%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1%20fullnat%20%E6%A8%A1%E5%BC%8F%E5%92%8C%20nat%20%E6%A8%A1%E5%BC%8F%E7%9A%84%E5%8C%BA%E5%88%AB/06.png?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当应用层调用 getpeername() 或者 getsocketname() 时，会进入到 inet_getname_toa,如果存在toa 信息则将 socket 存放的真是的 clientip 返回给应用层。</p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/26.LVS三种模式详解 - DR/">LVS三种模式详解 - DR</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="DR模式（直接路由模式）"><a href="#DR模式（直接路由模式）" class="headerlink" title="DR模式（直接路由模式）"></a>DR模式（直接路由模式）</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Virtual server via direct routing (vs/dr)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式是通过改写请求报文的目标MAC地址，将请求发给真实服务器的，而真实服务器响应后的处理结果直接返回给客户端用户。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;同TUN模式一样，DR模式可以极大的提高集群系统的伸缩性。而且DR模式没有IP隧道的开销，对集群中的真实服务器也没有必要必须支持IP隧道协议的要求。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;但是要求调度器LB与真实服务器RS都有一块网卡连接到同一物理网段上，必须在同一个局域网环境。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式是互联网使用比较多的一种模式。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;DR模式原理图：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E4%B8%89%E7%A7%8D%E6%A8%A1%E5%BC%8F%E8%AF%A6%E8%A7%A3%20-%20DR/01.png?raw=true" alt=""></figure></p>
<h3 id="DR模式原理过程简述："><a href="#DR模式原理过程简述：" class="headerlink" title="DR模式原理过程简述："></a>DR模式原理过程简述：</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;VS/DR模式的工作流程图如上图所示，它的连接调度和管理与NAT和TUN中的一样，它的报文转发方法和前两种不同。DR模式将报文直接路由给目标真实服务器。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在DR模式中，调度器根据各个真实服务器的负载情况，连接数多少等，动态地选择一台服务器，不修改目标IP地址和目标端口，也不封装IP报文，而是将请求报文的数据帧的目标MAC地址改为真实服务器的MAC地址。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;然后再将修改的数据帧在服务器组的局域网上发送。因为数据帧的MAC地址是真实服务器的MAC地址，并且又在同一个局域网。那么根据局域网的通讯原理，真实复位是一定能够收到由LB发出的数据包。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;真实服务器接收到请求数据包的时候，解开IP包头查看到的目标IP是VIP。（此时只有自己的IP符合目标IP才会接收进来，所以我们需要在本地的回环借口上面配置VIP。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;另：由于网络接口都会进行ARP广播响应，但集群的其他机器都有这个VIP的lo接口，都响应就会冲突。所以我们需要把真实服务器的lo接口的ARP响应关闭掉。）然后真实服务器做成请求响应，之后根据自己的路由信息将这个响应数据包发送回给客户，并且源IP地址还是VIP。</p>
<h3 id="DR模式小结："><a href="#DR模式小结：" class="headerlink" title="DR模式小结："></a>DR模式小结：</h3><ol>
<li><p>通过在调度器LB上修改数据包的目的MAC地址实现转发。注意源地址仍然是CIP，目的地址仍然是VIP地址。</p>
</li>
<li><p>请求的报文经过调度器，而RS响应处理后的报文无需经过调度器LB，因此并发访问量大时使用效率很高（和NAT模式比）</p>
</li>
<li><p>因为DR模式是通过MAC地址改写机制实现转发，因此所有RS节点和调度器LB只能在一个局域网里面</p>
</li>
<li><p>RS主机需要绑定VIP地址在LO接口上，并且需要配置ARP抑制。</p>
</li>
<li><p>RS节点的默认网关不需要配置成LB，而是直接配置为上级路由的网关，能让RS直接出网就可以。</p>
</li>
<li><p>由于DR模式的调度器仅做MAC地址的改写，所以调度器LB就不能改写目标端口，那么RS服务器就得使用和VIP相同的端口提供服务。</p>
</li>
</ol>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/25.LVS三种模式详解-IP Tunnel/">LVS三种模式详解-IP Tunnel</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="TUN模式"><a href="#TUN模式" class="headerlink" title="TUN模式"></a>TUN模式</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;virtual server via ip tunneling模式</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;采用NAT模式时，由于请求和响应的报文必须通过调度器地址重写，当客户请求越来越多时，调度器处理能力将成为瓶颈。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;为了解决这个问题，调度器把请求的报文通过IP隧道转发到真实的服务器。真实的服务器将响应处理后的数据直接返回给客户端。这样调度器就只处理请求入站报文，由于一般网络服务应答数据比请求报文大很多，采用VS/TUN模式后，集群系统的最大吞吐量可以提高10倍。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;VS/TUN的工作流程图如下所示，它和NAT模式不同的是，它在LB和RS之间的传输不用改写IP地址。而是把客户请求包封装在一个IP tunnel里面，然后发送给RS节点服务器，节点服务器接收到之后解开IP tunnel后，进行响应处理。并且直接把包通过自己的外网地址发送给客户不用经过LB服务器。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Tunnel原理流程图</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E4%B8%89%E7%A7%8D%E6%A8%A1%E5%BC%8F%E8%AF%A6%E8%A7%A3-IP%20Tunnel/01.png?raw=true" alt=""></figure></p>
<h3 id="原理图过程简述："><a href="#原理图过程简述：" class="headerlink" title="原理图过程简述："></a>原理图过程简述：</h3><ol>
<li><p>客户请求数据包，目标地址VIP发送到LB上。</p>
</li>
<li><p>LB接收到客户请求包，进行IP Tunnel封装。即在原有的包头加上IP Tunnel的包头。然后发送出去。</p>
</li>
<li><p>RS节点服务器根据IP Tunnel包头信息（此时就又一种逻辑上的隐形隧道，只有LB和RS之间懂）收到请求包，然后解开IP Tunnel包头信息，得到客户的请求包并进行响应处理。</p>
</li>
<li><p>响应处理完毕之后，RS服务器使用自己的出公网的线路，将这个响应数据包发送给客户端。源IP地址还是VIP地址。（RS节点服务器需要在本地回环接口配置VIP）</p>
</li>
</ol>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/24.LVS 三种模式详解 - NAT模式/">LVS 三种模式详解 - NAT模式</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS三种模式： NAT、IP Tunnel、DR</p>
<h2 id="NAT模式-网络地址转换"><a href="#NAT模式-网络地址转换" class="headerlink" title="NAT模式-网络地址转换"></a>NAT模式-网络地址转换</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Virtualserver via Network address translation(VS/NAT)</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这个是通过网络地址转换的方法来实现调度的。首先调度器(LB)接收到客户的请求数据包时（请求的目的IP为VIP），根据调度算法决定将请求发送给哪个后端的真实服务器（RS）。然后调度就把客户端发送的请求数据包的目标IP地址及端口改成后端真实服务器的IP地址（RIP），这样真实服务器（RS）就能够接收到客户的请求数据包了。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;真实服务器响应完请求后，查看默认路由（NAT模式下我们需要把RS的默认路由设置为LB服务器的地址。）把响应后的数据包发送给LB，LB再接收到响应包后，把包的源地址改成虚拟地址（VIP）然后发送回给客户端。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;调度过程IP包详细图：</p>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%20%E4%B8%89%E7%A7%8D%E6%A8%A1%E5%BC%8F%E8%AF%A6%E8%A7%A3%20-%20NAT%E6%A8%A1%E5%BC%8F/01.png?raw=true" alt=""></figure></p>
<h3 id="原理图简述："><a href="#原理图简述：" class="headerlink" title="原理图简述："></a>原理图简述：</h3><ol>
<li><p>客户端请求数据，目标IP为VIP</p>
</li>
<li><p>请求数据到达LB服务器，LB根据调度算法将目的地址修改为RIP地址（RS的内网IP）及对应端口(8080)，此RIP地址是根据调度算法得出的。并在连接HASH表中记录下这个连接。</p>
</li>
<li><p>数据包从LB服务器到达RS服务器，然后RS进行响应。RS的网关必须是LB的内网ip，然后将数据返回给LB服务器。</p>
</li>
<li><p>收到RS的返回后的数据，根据连接HASH表修改源地址VIP和目标地址CIP及对应端口80，其中源地址变成了VIP，目的地址变成了CIP，这样数据就从LB出发到达客户端。</p>
</li>
<li><p>客户端收到的就只能看到VIP\DIP信息。</p>
</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;总结： NAT模式最重要的环节就是第2和第4，这两步是通过iptables的nat表实现的，就是所谓的网络地址转换。</p>

	

	

</article>





	<span class="different-posts">📖 <a href="/page/34">more posts</a> 📖</span>



	</main>

	<footer class="footer">
	<div class="footer-content">
		
	      <div class="footer__element">
	<p>Hi there, <br />welcome to my Blog glad you found it. Have a look around, will you?</p>
</div>

	    
	      <div class="footer__element">
	<h5>Check out</h5>
	<ul class="footer-links">
		<li class="footer-links__link"><a href="/archives">Archive</a></li>
		
		  <li class="footer-links__link"><a href="/atom.xml">RSS</a></li>
	    
		<li class="footer-links__link"><a href="/about">about page</a></li>
		<li class="footer-links__link"><a href="/tags">Tags</a></li>
		<li class="footer-links__link"><a href="/categories">Categories</a></li>
	</ul>
</div>

	    

		<div class="footer-credit">
			<span>© 2017 失落的乐章 | Powered by <a href="https://hexo.io/">Hexo</a> | Theme <a href="https://github.com/HoverBaum/meilidu-hexo">MeiliDu</a></span>
		</div>

	</div>


</footer>



</body>

</html>
